The Request You Cannot Fully Answer
Sometimes the data is gone, scattered or unreachable. Saying so clearly is a better position than a partial response that implies completeness.
INCOMPLETE RESPONSE NOTE
Sent with the response, not afterwards
- What was providedSystems searched and material suppliedThe complete list
- Not heldCategories genuinely not processedSay it rather than leaving silence
- DeletedWhat was deleted, when, under which scheduleLawful deletion is an answer, not a failure
- Not reachableBackups, decommissioned systemsWith the proportionality reason
- Not searchedSystem and reasonStated, never silent
- If they disagreeHow to come back, and to whomIncluding the regulator
- ClockResponse sent within the periodEven an incomplete response must be on time
A request arrives for material that was lawfully deleted, sits in a decommissioned system, or spans eight years of email nobody can reasonably search. The response still has to go out on time.
The response discipline in “The Request You Cannot Fully Answer” also applies to records created by workforce software. A team using review the platform here in relation to attendance sheet template should know where data is stored, who can export it, how long it remains available and how a person can challenge a misleading record before a request arrives.
The three honest answers
We do not hold it. Some categories genuinely are not processed, and saying so explicitly is better than silence that reads as omission.
For a separate benchmark relevant to “The Request You Cannot Fully Answer”, consult the CSO insider-threat guide. Use it to test purpose, data flow, retention, access and response procedures rather than substituting a generic checklist for the organisation’s actual records.
We held it and deleted it, under this schedule, on this date. Lawful deletion is a complete answer and it demonstrates the retention schedule is operating — which is a good finding rather than a bad one.
It exists but reaching it would be disproportionate, with the reason. Backups and archives requiring restoration are the usual case.
Each is defensible. What is not defensible is a partial response presented as complete.
Why silence is the error
A person who knows a document exists and does not receive it concludes it was hidden.
Where it was deleted, say so. Where it is in a backup you are not restoring, say so. The explanation converts an apparent concealment into a stated judgement they can challenge if they wish.
The deleted-material case specifically
If the retention schedule required deletion and deletion happened, the answer is straightforward and the schedule is the evidence.
If material was deleted after the request arrived, that is a serious problem. A request triggers a hold on anything within its scope, and routine deletion must be suspended for that material until the response is sent.
This is the step most often missed, and an automatic purge running mid-request is the version that produces a complaint with substance.
Sending something rather than nothing
An on-time response that is incomplete and explains itself is in a far better position than a complete response sent six weeks late.
Where more will follow, say what and by when, and then do it.
The route onward
Tell them how to come back if they think something is missing, and that they may complain to the regulator.
Including the second is not an invitation. It is a requirement in most regimes, and omitting it is a separate failing on top of whatever else is in dispute.
Suspending deletion when a request arrives
Routine purges must be paused for material in scope until the response is sent. An automatic job running mid-request is the version that produces a complaint with substance, and it fails silently.
An on-time incomplete response that explains itself is in a far better position than a complete one six weeks late. Where more will follow, say what and by when, and then do it.
Why silence reads as concealment
Somebody who knows a document exists and does not receive it concludes it was hidden. Saying it was deleted, or is in a backup you are not restoring, converts an apparent concealment into a stated judgement.
We do not hold it. We held it and deleted it under this rule on this date. It exists and reaching it would be disproportionate, for this reason. Each is defensible; a partial response presented as complete is not.
Telling them how to come back
Including that they may complain to the regulator. Omitting it is a separate failing on top of whatever else is in dispute, and it is required in most regimes.
Saying what will follow
Where more material will come, say what and by when, and then do it. An incomplete response with a stated next step is a process; one without is an omission with an explanation attached.